05000499/LER-2002-002
| South Texas Unit 2 | |
| Event date: | |
|---|---|
| Report date: | |
| 4992002002R00 - NRC Website | |
NAME
DESCRIPTION OF EVENT
On June 14, 2002 while operating at 100 percent power, Unit 2 lost feedwater flow to steam generator 2C while performing Feedwater Valve Operability Test. This test performs a partial stroke of the feedwater isolation valve from 100 percent to 90 percent open. During the test, the 2C feedwater valve failed closed.
This event occurred following the successful testing of the 2A and 2B main feedwater isolation valves (FWIV). At 0435, the control room operator pushed the test button for the 2C FWIV, in accordance with the surveillance procedure, for approximately 1 second and then released it. The 2C FWIV continued to go in the closed direction, going full closed in approximately four seconds. The plant operator stationed at the FWIV notified the main control room by radio that the valve was continuing to go closed as it passed through the 50 percent open position. The plant operator and the secondary Reactor Operator in the control room reported the valve had gone full closed. The Unit Supervisor directed the secondary Reactor Operator to check feedwater flow to the 2C steam generator. The secondary reactor operator reported there was no indication of feedwater flow to the 2C steam generator. The Unit Supervisor ordered the primary Reactor Operator to manually trip the reactor.
Following the reactor trip, neither the steam generator power operated relief valves or the steam generator safety valves opened, nor were they challenged. Auxiliary feedwater automatically actuated. There were no human performance issues or challenges to plant safety and the plant responded as expected.
The unexpected closure of the 2C FWIV resulted from a blown fuse in the Class-1E control circuit for the 2C FWIV B train safety solenoid. The blown fuse was the result of a shorted B train safety solenoid surge suppression device that contains four series parallel diodes. Two of the four internal diodes were shorted providing a direct short-circuit path around both redundant safety solenoid coils.
EVENT SIGNIFICANCE
This event resulted in no personnel injuries, offsite radiological releases or damage to important safety related equipment. An evaluation of this event by Probabilistic Risk Assessment determined the Conditional Core Damage Probability was 3.1 x10 (-7) which shows the risk was minimal. This event is an important issue for the station due to the impact on plant reliability and because it caused the loss of all feedwater flow to one steam generator while at 100 percent power. Feedwater flow is necessary to maintain the steam generator's ability to remove heat from the reactor. The 2A, 2B and 2D steam generators were available during this event to remove heat from the reactor. This loss of feedwater flow challenged the automatic actuation of the auxiliary feedwater system and the operating crew's response to this abnormal situation.
CAUSE OF EVENT
The cause of the unexpected closure of 2C FWIV was a shorted surge suppression device in the Class-1E control circuit.
The suppression device contains four series parallel diodes and is actually a diode bridge. The diode bridge is used for surge suppression across the safety related trip solenoids. This short caused the fuse to blow in the control circuit, which de-energized the B-train safety solenoid. De-energizing the B-train solenoid dumps hydraulic fluid from the valve actuator allowing the FWIV to close.
The failed diode bridge was sent off site for a laboratory failure analysis to determine the cause of the failure. The report from the laboratory listed the cause for the diode failures as electrical overstress.
The location of the melt sites on the two short circuited diodes indicate that one was most likely damaged by a reverse bias voltage transient and the other by a forward current transient. The cause for the electrical overstress cannot be determined. The control circuit was analyzed and found to be satisfactory. The diodes are rated at 10 amps and 600 volts, which is adequate for the circuit in which they are installed. The diodes are normally reverse biased at 125 volts direct current and the control circuit is fused at 3 amps. The root cause for the electrical overstress is unknown and considered to be a random failure. See Additional Information section for possible failure scenarios.
CORRECTIVE ACTIONS
1. Replaced the blown fuse and the failed surge suppression device for the 2C FWIV.
Completed June 20, 2002 2. Checked the condition of individual diodes in the bridge circuits for 2A, 2B and 2D FWIVs.
Completed, June 17, 2002, no additional diode damage was found.
3. Test Unit 1 FWIV solenoid operated dump valves for failed diodes during a forced outage or during the refueling outage in 2003. Due date April 30,2003
ADDITIONAL INFORMATION
Following the reactor trip, the Source Range nuclear instrumentation detectors were automatically energized, at approximately 0447 the operators noted that both instrument channels were not indicating a count rate. The Extended Range nuclear instruments were operating and were monitored to determine reactor status. The Source Range detectors were found to be failed and were replaced prior to reactor startup.
ADDITIONAL INFORMATION (cont) The risk of similar failures on this and other FWIV control circuits was evaluated based upon the potential circuit issues that could lead to surge suppressor diode failure, none were identified.
Available operating experience and vendor failure history information was evaluated and indicated no known history of failure for these devices. No known circuit design issues were identified that could account for the failure. As a remedial action, all remaining Unit 2 FWIV diodes were functionally checked to ensure that no single diode failures existed. This testing was completed before the unit was restarted. A condition report was prepared to perform the same inspections and testing for the Unit 1 diodes during a forced outage or during the next refueling outage in 2003. The FWIVs are susceptible to this type of failure and other single point failures during the performance of surveillance testing and during normal operation. Each FWIV has two safety related solenoids that can trip the valve closed. Each safety solenoid consists of two solenoids, one is energized all the time and the other de-energizes 60 seconds after the FWIV is opened. Both solenoids are required to energize in order to open the FWIV, with only one required to maintain the valve open. During this plant trip, the de-energized solenoid was the one with the failed surge suppression device.
Modification documentation has been prepared to install the FWIV Energize to Actuate modifications in Units 1 and 2. These modifications will eliminate single point control circuit failures that lead to valve closure.
A Condition Report work order to test the FWIV circuits for hidden failures and degraded conditions has been developed. These tests will be performed, during a forced or planned outage, until the Energize to Actuate modifications are completed for the FWIVs.
A review of South Texas condition report events revealed no events where the apparent cause referenced a diode failure for a FWIV. Diode failures have been identified for the main generator exciter and rod control power blocking diodes. These applications are different in that those diodes are critical current carrying components that opened resulting in circuit interruption. Numerous fuse failures were found but none referenced to diode failures.
A review of industry events found numerous diode failures in Protection systems. Fifteen events found "random/Unknown" failure modes. Ten failure events were identified as "age related". Two failures resulted from "design/installation" deficiencies and no other failure mechanisms had more than one event.
ADDITIONAL INFORMATION (cont) The event review team for this event evaluated the FWIV Class-1E control circuit for the following potential issues that could lead to surge suppression diode failure:
1. Over-current stress The surge suppression device is a 10-ampere, full-wave bridge rectifier. The maximum current expected through the diodes in this application is less than 0.2 amperes and lasts less than one second. No transient current sources were identified in this circuit that would be capable of stressing these diodes and the 3-ampere supply fuses that are rated well below the diode rating would most likely limit such a condition before diode damage could occur.
2. Over-voltage stress The peak-inverse-voltage rating of the diodes is 600 volts; well above the circuit maximum of approximately 140 volts. Similar to the above, no transient voltage sources were identified in the circuit that would be capable of stressing these diodes.
3. Over-temperature stress The rated operating temperature of these diodes is 100 degrees-C, well above the diodes located in the isolation valve cubicle temperature, and there is no internal heating of these diodes since they are for surge suppression only and do not carry any circuit current. Laboratory failure analysis confirmed there was no evidence of over temperature stress.
4. Manufacturing defects The supplier, Valcor, was contacted for information on failure history of the device, expected life and temperature effects, device improvement history and Class-1E qualification basis information. Valcor provided data indicating that there are literally thousands of these devices in service worldwide with no reported operational failures. Our operating experience search yielded only one similar event, and it was a different manufacturer.
5. Mechanical failures Mechanical failures such as vibration, dropping, and mishandling were evaluated briefly but it was concluded that mechanical damage would most likely result result in an open rather than a shorted diode.
The failed surge suppression device/rectifier assembly was manufactured by Valcor, manufacturer part number S1140-8-1.
Diode failures referencing vendor Valcor, the supplier of the South Texas FWIV diodes, were reviewed. Four events were found with two finding no known cause, one failure due to age and one failure due to overload when a valve motor seized. There does not appear to be a generic issue with the vendor for this component.